1. Field of Invention
This invention relates to the software interfaces in data processing systems and more particularly to a method and a device for protecting software commands in an aircraft cockpit, in order to control the execution of software commands through a display and control system.
2. Description of Related Art
Avionic display systems, also called CDS (abbreviation for Control and Display System in English terminology) have evolved extensively in their functionalities during recent years. Whereas at the outset they consisted of simple display systems, today they allow an interactivity with the crew in particular by enabling crew members to carry out control and command operations on the avionic systems through data capture and selection means such as a keyboard and a trackball-type pointing device.
FIG. 1 schematically illustrates the architecture of a hardware configuration for control and display in an aircraft cockpit. As illustrated, hardware configure 100 comprises at least one computer 105 accommodating a server for management of display of graphical objects (CDS) connected to an avionic system 110 comprising avionic applications referred to as client applications, at least one screen 115, for example an LCD (abbreviation for Liquid Crystal Display in English terminology) screen, and, in particular if this screen is not sensitive, data capture and selection means 120, also called KCCU (abbreviation for Keyboard and Cursor Control Unit in English terminology). Data capture and selection means 120 are, for example, connected to CDS 105 via a private network 125 that may be of CAN (abbreviation for Controller Area Network in English terminology) type.
Avionic system 110 executes, for example, applications such as engine management applications or fuel management applications the parameters of which may be displayed and/or modified by the crew members. These parameters thus may be transmitted to CDS 105, in charge of displaying them on screen 115. If the pilot wishes to modify a value or activate an element, he selects same and, if need be, modifies it via data capture and selection means 120. This modified value then is transmitted by the CDS to the avionic system which then is able to use it. The CDS thus may be regarded as a resource for display of data originating from the avionics. The CDS and the avionics exchange information items in order to update displayed elements and notify the crew members of events.
Nevertheless, since certain commands affected by these actions may have particularly significant effects for management of the aircraft, it may be necessary to use mechanisms for protection against untimely pressing of the physical command buttons by members of the crew, as is found today.
In fact, for example, the command devices, on the overhead panel of cockpits, the actions of which are irreversible or significant for operation of the aircraft are protected by a colored cover called guard. These protections require the crew members to perform at least two actions in order to carry out the intended command (lift up the guard and press the button).
FIG. 2 schematically illustrates a part of an overhead panel of an aircraft cockpit comprising systems command buttons, some of which are provided with a guard. The guards make access to these buttons more secure and indicate to the crew the significance of the action to be performed. In this way, in order to press a button, it is necessary first of all to lift up the guard.
Part 200 of an aircraft overhead panel shown here comprises a first zone 205-1 linked to management of engine fire extinguishing and a second zone 205-2 linked to management of hydraulic resources. The first zone comprises in particular a button 225 associated with an auxiliary power unit (APU, abbreviation for Auxiliary Power Unit in English terminology). Since this button is situated behind a guard 210, it is not directly accessible and cannot be manipulated by mistake. Guard 210 comprises a hinge 215 on one side and, on an opposite side, a lug 220 making it possible to lift it up so as to reach button 225 situated underneath in order to activate the corresponding command. Moreover, such a button typically comprises lighting means to warn the pilot about the command to be selected.
Thus, typically, when a fire alarm affecting the auxiliary power unit is generated and a function for shutting down this unit is activated, button 225 situated underneath guard 210 lights up. The pilot then may lift up guard 210 and press this button to cut off the fuel supply of the auxiliary power unit and shut it down.